Engineering notebook / 11
Engine 6 Preview is being developed and tested to make policy retrieval, comparison and validation more traceable. This page opens the design for inspection.
ArchitectureLatest research / 7 November 2026
PolicyWatcher keeps its stable 5.5.0 service while Engine 6 Preview r3 advances in a separate authenticated workspace. The 7 November verification records a deployed claim-ledger schema and one bounded Apple run. Completeness, semantic accuracy and full 500-policy/day operation remain unqualified.
Private r3 is online with 47 application tables and 22 migrations. Thirteen authenticated checks passed. EngineClaim and EngineClaimEvidence provide the deployed ledger schema; the bounded hosted run did not exercise ledger writes.
One administrative run covering four Apple policies completed in 8.027 seconds. One fresh HTTP 200 capture remained confirmation_pending; three policies were held because source contracts were missing. Completed tasks do not mean four acquired or qualified documents.
Nine official and configuration table hashes remained unchanged across deployment and the run. Both earlier private reports were preserved. Publication and notifications remain disabled.
The run reached neither AI analysis nor the separate verifier. Both claim-ledger tables remain empty. It does not demonstrate semantic accuracy, hosted ledger write behaviour, source completeness, uninterrupted worker recovery or full operation at 500 policies per day.
PolicyWatcher 5.5.0 is the stable public service, released on 2 November. It retains the established scanner. r3 identifies a private Preview revision, not a new stable release.
Preview r3 requires administrator access in the separate environment. Anyone can inspect the architecture, evidence and limits here. Experimental scans, reports and results remain private.
No. The local trial on 500 candidate endpoints attempted 498 retrievals, accepted 383 responses and produced 342 extractions. It did not include the full AI pipeline and does not qualify complete hosted operation.
Check the document identity, required sections, language and final passage against a reviewed source contract.
Keep frozen captures, exact quotations and a separate verification step connected to each proposed change.
Save tasks, attempts and checkpoints so interruption does not erase progress or publish a change twice.
01 / Architecture
Official sources enter a private working area. This diagram documents the full engine architecture, including its publication boundary. The private preview records observations with publication and delivery disabled. Retrieval, AI analysis and delivery have separate responsibilities.
Direct HTTP, HTTP/2 and a configured browser renderer supply bounded retrieval paths. Archive captures do not attest current live availability.
Durable tasks, per-origin backoff, frozen artifacts and checkpoints preserve the retrieval and reasoning trail. Observation and publication keep separate policy state.
Complete, supported changes may commit automatically at lower impact. High impact requires review; missing or uncertain evidence remains held.
The baseline, version, change record and queued notification event commit together. Delivery happens later and checks subscription preferences again.
02 / Decision flow
The change path requires two fresh captures in distinct runs, separated by at least one hour and no more than seven days. A 304 response can revalidate a stored representation; it cannot confirm a new change.
Missing contract, source drift, incomplete content or uncertain language → hold and record the reason.
Unchanged content → record a verified check. Missing or incompatible baseline → review before comparison.
A matching fresh capture in a different run confirms the candidate. A retry or a conditional 304 response does not count as a second capture.
The analyst must cover the complete delta with exact old/new quotations. A separate verifier assesses every claim and both language versions.
Unsupported or uncertain claims → hold. Verified high impact → human review. Complete supported lower-impact changes → atomic commit when publication is enabled.
Human approval does not waive missing evidence. Source or extraction-baseline repairs have their own review path. A purely presentational extraction change does not become a provider policy-change alert.
03 / Entity relationships
This is a conceptual map of the implemented preview schema. A solid line is an explicit database foreign key; dashed lines are application-managed references, including identifiers in checkpoints and evidence payloads.
Scroll horizontally to read every column. Keyboard: focus the table area and use the arrow keys.
| Entity | What it records | Relationship / identity |
|---|---|---|
| EngineRun → EngineTask | A requested run, immutable channel/configuration metadata and its resumable work. | Explicit runId foreign key; one run has many tasks. |
| EngineAttempt | Each claimed task stage and its outcome. | Logical taskId; attempt history is separate from the current task. |
| EngineArtifact | Frozen captured or derived evidence with integrity checks. | Content-addressed ID; logical references from checkpoints and evidence payloads. |
| EngineSourceContract | Reviewed expectations for one source document. | policyId identity; logical relationship to Policy. |
| EnginePolicyState | Due time, last verified state and candidate confirmation. | Composite identity (policyId, mode); observe and publish are separate. |
| EngineOrigin · EngineHttpCache | Per-origin pacing and eligible conditional representations. | Origin / cache-key identities; cache logically references an artifact. |
| EngineClaim / EngineClaimEvidence (r3) | Proposed claims, verifier verdicts and exact before/after quotation offsets. The bounded hosted run created no rows. | claimId is a database FK with cascade deletion; taskId, policyId, reviewId and changeId are application references. |
| EngineReview | Frozen evidence, reason, decision and review history. | Unique taskId/evidenceKey; logical policy, artifact and change references. |
| Policy · PolicyChange · EngineOutbox | Public baseline, committed change and deferred delivery. | PolicyChange → Policy is an existing FK; outbox changeId is an application reference. |
11 November: Fable audit, r4 fixes and remaining limits9 November: real API results, failures and worker diagnosticO2 assessment: evidence, counterexamples and Gemini/GLM reviews (7 November)
04 / Validation
Recorded verification, updated 11 November 2026. Historical regression and campaign results are retained. Local production-mode and generated standalone-server checks are reported separately from hosted verification and production accuracy.
Read-only model-assisted inspection, not execution or certification. The original report and the subsequent patch review distinguish bounded fixes from open research gates. O2 remains open.
1,624 local tests passed, 14 skipped. The independent patch review exposed two regressions, reproduced and corrected: SDK compatibility and recovery after an acquisition hold. Sensitive-source routing, bounded provider diagnostics and administrative readiness were strengthened. This is a new candidate, separate from hosted r3; no r4 deployment, live semantic result or 500-policy/day qualification is claimed.
Twelve authored synthetic cases, 17 generation attempts, no retries. Verifier: 8 HTTP 504, 2 HTTP 503 and 1 AbortError. Unavailability is not a correct rejection or a semantic verdict. Applicable-law risk was flagged despite model impact 5; consent wording remains disputed in advisory review.
Controlled HTML transport and an explicitly rewound lab timer, not live source acquisition or elapsed observation days. Policy, snapshots and baseline preserved; zero public changes, notifications or claim-ledger rows. The workflow did not complete.
A dedicated local credential enables bounded experiments. This does not configure hosted r3 or qualify semantics. Observed quotas: analyst 500 requests/day, verifier 20. The latter cannot support 500 changed documents requiring verification per day; 500 unchanged checks are a different workload.
Offline diagnostics and injected model responses, not live semantic accuracy. Unsupported, uncertain, missing-verdict and same-model cases retain private evidence without public effects.
An integral linked annex remains outside the acquired parent. Exact quotations do not establish entailment; the live verifier is still unmeasured. Table-span markers and hidden exception text were retained, so those fixtures do not prove text loss.
Read-only check at 20:58 UTC: no Gemini credential or analyst/verifier model in deployment configuration, zero claim-ledger rows. Browser Gemini/GLM reviews are advisory. General completeness, semantic accuracy and 500 fully processed policies/day remain unqualified; free-only access is required.
One bounded Apple run: 8.027 seconds, one HTTP 200 held pending confirmation, three missing source contracts. No inference or claim-ledger rows; publication and notifications disabled. Source completeness and full 500-policy/day operation remain unqualified.
Local Mac acquisition/extraction only, 305 service names and 290 origins from pinned Open Terms Archive metadata. Two endpoints skipped after origin backoff; all failures retained. No models, renderer or reviewed contracts. This does not qualify 500 fully processed policies/day.
One document, later independent browser request and occurrence-aware normalized comparison. Stable replay hash matches the hosted receipt. Linked documents and PDF copies are outside this sample; no general completeness approval.
Missing middle clause, repeated occurrence, table row or section body can survive title/heading/tail/length checks. This demonstrates a contract limitation, not a proven live omission or public false alert.
Completed in 7.802 seconds, observe/silent. Eight official/configuration table hashes, release metadata and the previous report were preserved. No AI inference or public policy change. Main candidate separately passed 120 engine tests; 500 injected expired leases recovered in 1.062 seconds.
An initial CI failure caught a stale whole-engine manifest; it was regenerated without weakening the guard. The encoding correction is separate from the hosted artifact and requires a new live cohort. No injection exploit was established.
One source contract was eligible; three other policies remained held. Public records and notifications were unchanged. An earlier read timeout is retained; sustained hosting availability and full coverage remain unqualified.
Standalone startup, HTTP/worker identity and missing-flag privacy verified. The first hosted build failure and the corrected local harness failure remain recorded. This row does not establish online availability.
Authentication boundaries, shared HTTP/worker identity and observe/silent restrictions were checked. Initial HTTP shells do not demonstrate hydrated browser controls; these local checks do not verify hosted deployment.
Both extractors used the same response. Outcome: confirmation_pending. No AI calls; official policy, baseline, public history and outbox records were unchanged. More characters do not prove completeness or correctness.
The process was killed after the live run had completed. This checks persisted queued work and leadership expiry, not interruption during a network fetch. Official records and notification events remained unchanged.
Synthetic fixtures do not measure retrieval quality on the live catalogue.
A 500-record scheduling test is not 500 successful Internet retrievals.
15 pre-existing web lint warnings remain; no independent dynamic security audit is claimed.
One clearly labelled synthetic policy; no subscriber notifications.
Two synthetic local policies: one extraction difference and one unavailable comparison. All policy fields preserved; zero official changes, check logs or notification events. Matching text would still leave completeness unqualified.
101 endpoints retrieved; 105 of 109 document scopes extracted. Four scopes failed retrieval/extraction; 79 extracted scopes still have unresolved structural checks. No source completeness is approved. Local Mac, no models or production writes.
The bounded temporal target is met. Latest capture: 12/12 direct HTTP 200 in 39.631 seconds, no retry, fallback or 304. On 4 November, 12/12 took 46.168 seconds. This is not source completeness, weekly reliability or 500-source capacity.
Meta timed out on direct retrieval and HTTP/2 fallback. All 13 attempts and the 162.566-second failed window remain preserved. Today’s success does not erase that failure or add a retrospective day.
The saved AWS text has a new date, AWS Quick naming and AWS assistant Free Tier references in sections 50.10 and 50.13; net increase 52 characters. The earlier section-83 difference remains recorded. Snapshot differences are not legal interpretation, completeness approval or public policy-change notices.
This earlier cohort remains incomplete and belongs to the previous parser. Its minimum observed span is 20.77 hours. At least 3 distinct dates, 20 hours between windows and 48 hours overall are required. PDF language remains unverified.
Expiry was injected in an isolated local database. A crash could leave a completed run marked as active; two reproduced regressions now pass after the recovery fix. VPS and 500-source live capacity remain unqualified.
Review is not execution or certification. Subsequent fixes were tested locally.
The bounded three-date observation is complete. Daily captures for this gate stop here; the failed 3 November window stays excluded and preserved. Work now focuses on independent source-completeness annotation, PDF language and original bytes, origin freshness, realistic capacity, evidence retention and recovery. The target is up to 500 policies per day; this scale is not yet qualified. Future temporal monitoring requires a new stated question and protocol.
OCR for scanned PDFs, general PDF structure recovery, automatic source-contract onboarding and automatic evidence pruning are outside this preview. Ambiguous documents remain in review.
